EIP-2026-104236

PRE-CVE

Emby MediaServer 3.2.5 - Password Reset

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104236. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in Emby MediaServer versions 3.2.5 and earlier. It allows an unauthenticated attacker on the same network to reset all user passwords to blank by exploiting a password reset feature and a file disclosure vulnerability.

Description

Emby MediaServer 3.2.5 - Password Reset

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textwebappsmultiple
https://www.exploit-db.com/exploits/41947

This exploit demonstrates an authentication bypass vulnerability in Emby MediaServer versions 3.2.5 and earlier. It allows an unauthenticated attacker on the same network to reset all user passwords to blank by exploiting a password reset feature and a file disclosure vulnerability.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Emby MediaServer 3.2.5 and earlier
No auth needed
Prerequisites: Network access to the target Emby server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026